The ThreatFox: ClearFake IOCs rule detects potential adversary activity associated with the ClearFake malware, which is known for distributing malicious payloads through compromised websites and phishing campaigns. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage attacks that could lead to data exfiltration or system compromise.
IOC Summary
Malware Family: ClearFake Total IOCs: 48 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | mxmzjcfl.sakhtemandade.shop | payload_delivery | 2026-06-16 | 100% |
| domain | trwqprv.shartmag.bet | payload_delivery | 2026-06-16 | 100% |
| domain | zgdpxwcq.sadreislam.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | jyheezbl.questionsmotor.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | xoqlqpdb.psgnewsiran.com | payload_delivery | 2026-06-16 | 100% |
| domain | cnuwz.bankefile.com | payload_delivery | 2026-06-16 | 100% |
| domain | tuwlc2yd.hesabdarinoravesh.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | 3kh6tu2u.shimiumumi.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | nglrdgbx.prozhedownload.com | payload_delivery | 2026-06-16 | 100% |
| domain | nnozsfst.prozhecart.com | payload_delivery | 2026-06-16 | 100% |
| domain | ckvcsacd.mechanicsayalat.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | gafaiyfx.mechanickhodakarami.shop | payload_delivery | 2026-06-16 | 100% |
| domain | 4nhtw4lz.testranandegi.com | payload_delivery | 2026-06-16 | 100% |
| domain | zsmhobv.shartmag.bet | payload_delivery | 2026-06-16 | 100% |
| domain | qvwjatwu.masirpayambari.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | naqsigxg.masaelmohandesi.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | mnzrz.azmoonzare.online | payload_delivery | 2026-06-16 | 100% |
| domain | zejlnzmy.maharatmodiran.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | hxhqsvdq.mabanishimi.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | 82a3dcwt.sazehayefooladi.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | vtulyasw.leaguejazire.com | payload_delivery | 2026-06-16 | 100% |
| domain | tfpypiqq.karbordriyaziyat.xyz | payload_delivery | 2026-06-16 | 100% |
| domain | gyrtdqr.shartbandikade.online | payload_delivery | 2026-06-16 | 100% |
| domain | ruynyxnj.karafarini.shop | payload_delivery | 2026-06-16 | 100% |
| domain | cpclyyro.hugugtejarat4.xyz | payload_delivery | 2026-06-16 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["mxmzjcfl.sakhtemandade.shop", "trwqprv.shartmag.bet", "zgdpxwcq.sadreislam.xyz", "jyheezbl.questionsmotor.xyz", "xoqlqpdb.psgnewsiran.com", "cnuwz.bankefile.com", "tuwlc2yd.hesabdarinoravesh.xyz", "3kh6tu2u.shimiumumi.xyz", "nglrdgbx.prozhedownload.com", "nnozsfst.prozhecart.com", "ckvcsacd.mechanicsayalat.xyz", "gafaiyfx.mechanickhodakarami.shop", "4nhtw4lz.testranandegi.com", "zsmhobv.shartmag.bet", "qvwjatwu.masirpayambari.xyz", "naqsigxg.masaelmohandesi.xyz", "mnzrz.azmoonzare.online", "zejlnzmy.maharatmodiran.xyz", "hxhqsvdq.mabanishimi.xyz", "82a3dcwt.sazehayefooladi.xyz", "vtulyasw.leaguejazire.com", "tfpypiqq.karbordriyaziyat.xyz", "gyrtdqr.shartbandikade.online", "ruynyxnj.karafarini.shop", "cpclyyro.hugugtejarat4.xyz", "mszrd.mabanieslami2.xyz", "nvxwrvxi.tasisathosseini.shop", "shfbucmg.tarikhravannovin.shop", "hibwmmbn.shartbandi.games", "ez92gghl.ravanshenasinovin.xyz", "vb6axq3r.testdrivepaye3.com", "khfujqd.shartbandifootballkade.online", "tmajnhws.sazebetonarme.xyz", "cunozylb.sanjeshvaandazegiri.shop", "maxvicsh.sanjeshravani.shop", "tuivp.ecologyardakani.xyz", "cx2b8w38.anodaz.vip", "abmkzgbs.sakhtemandade.shop", "ihypqyrn.sadreislam.xyz", "fbvxbuzt.questionsmotor.xyz", "dbhmpap.shansline.com", "golkqcqa.psgnewsiran.com", "lp4hvt2f.ravanshenakhti.shop", "vdigvuaz.prozhedownload.com", "scsjldll.prozhedownload.com", "jehezikh.prozhecart.com", "btskl.downloadquran.xyz", "xkpxrkko.mechanicsayalat.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate System Update via Microsoft Update
Description: A system update from Microsoft’s Windows Update includes a file that matches one of the ClearFake IOCs due to a naming similarity.
Filter/Exclusion: Check the file path and source. Use file.name != "setup.exe" or process.parent_process contains "wuauclt.exe" to exclude Microsoft Update activities.
Scenario: Scheduled Job for Log Management (e.g., Splunk or ELK)
Description: A scheduled job runs to collect and process logs, and the log ingestion tool (e.g., Splunk or Fluentd) has a file or command that matches a ClearFake IOC.
Filter/Exclusion: Filter by process name: process.name != "splunkd.exe" or process.name != "fluentd", or check the command line for log management tools.
Scenario: Admin Task to Clean Malware with Malwarebytes
Description: An administrator uses Malwarebytes to scan and remove malware, and the cleanup process includes files that match ClearFake IOCs.
Filter/Exclusion: Use process.name contains "malwarebytes" or process.parent_process contains "malwarebytes.exe" to exclude legitimate cleanup activities.
Scenario: Backup Job Using Veeam or Acronis
Description: A backup job executed by Veeam or Acronis includes temporary files or scripts that match ClearFake IOCs due to similar naming conventions.
Filter/Exclusion: Filter by process name: process.name != "veeam.exe" or process.name != "acronis", or check for backup-related command-line arguments.
Scenario: PowerShell Script for System Monitoring (e.g., by SolarWinds or Nagios)
Description: A PowerShell script used for system monitoring (e.g.,